feat(images): Unify combined sidecar images, drop client-registration

[huang195]

Summary

Consolidates the authbridge container images down to two combined
sidecar variants, each bundling spiffe-helper that starts
conditionally based on SPIRE_ENABLED. Removes the in-pod
client-registration sidecar from this repo entirely (operator now
owns Keycloak client registration end-to-end).

Sets up the kagenti-extensions side of the larger work to flip the
default deployment mode from envoy-sidecar to proxy-sidecar.
Operator + chart updates land in follow-up PRs (Phase B + C).

Image layout

Image	Built from	Contents	Size
authbridge (proxy-sidecar combined, default mode)	cmd/authbridge/Dockerfile.proxy	authbridge-proxy + spiffe-helper	47.8 MB
authbridge-envoy (envoy-sidecar combined)	cmd/authbridge/Dockerfile.envoy	Envoy + authbridge (ext_proc) + spiffe-helper	165 MB
proxy-init (unchanged)	authproxy/Dockerfile.init	iptables init for envoy-sidecar mode only	—

Sizes are linux/amd64 (podman build, no extra strip). Size
optimization deferred to follow-ups.

Process supervision pattern

Both combined images use the same bash supervisor:

CRITICAL_PIDS=""

trap cleanup TERM INT  # graceful shutdown

if [ "$SPIRE_ENABLED" = "true" ]; then
  spiffe-helper -config=/etc/spiffe-helper/helper.conf run &
  CRITICAL_PIDS="$CRITICAL_PIDS $!"
fi

# Envoy variant also runs Envoy here
authbridge-proxy "$@" &  # or authbridge for envoy variant
CRITICAL_PIDS="$CRITICAL_PIDS $!"

wait -n $CRITICAL_PIDS         # block until any critical process exits
kill $CRITICAL_PIDS 2>/dev/null
exit 1                          # kubelet restarts pod

Verified behavior:

• Any critical process exits → kill the rest, exit non-zero, kubelet
  restarts. No silent process death.
• SIGTERM/SIGINT → trap fires, kill cleanly, exit 0.
• spiffe-helper does not start when SPIRE_ENABLED is unset/false.

Removals

• authproxy/Dockerfile.authbridge (old Envoy + everything combined)
• authproxy/entrypoint-authbridge.sh
• authproxy/authbridge-combined.yaml (operator-supplied per-agent
  ConfigMap supersedes the bake-in YAML)
• client-registration/ — entire directory. Operator's
  ClientRegistration controller creates Keycloak clients and the
  webhook mounts the Secret at /shared/client-id.txt +
  /shared/client-secret.txt (same paths the in-pod sidecar
  wrote to).
• spiffe-helper/Dockerfile (standalone — bundled into both combined
  images now).
• tests/test_client_registration.py (covered removed Python).
• TestAuthbridgeCombinedYAML_Loads (asserted deleted YAML).

Renames

• cmd/authbridge/Dockerfile → Dockerfile.envoy
• cmd/authbridge/Dockerfile.light → Dockerfile.proxy
• cmd/authbridge/entrypoint.sh → entrypoint-envoy.sh

Changes to Dockerfile.envoy (renamed Dockerfile)

Adds spiffe-helper bundling stage + conditional start in entrypoint.
UBI9-micro base unchanged (has bash + glibc, both needed).

Changes to Dockerfile.proxy (renamed Dockerfile.light)

• Switch build target from cmd/authbridge (full binary, ~17 MB) to
  cmd/authbridge-proxy (lite binary from PR feat(cmd): Add authbridge-proxy and authbridge-envoy lite binaries #407, no gRPC, ~9 MB).
• Switch base from distroless/static to alpine:3.20. Distroless
  has no shell — bash supervisor needs one. Alpine adds ~3 MB but
  matches the envoy variant's pattern.
• Add spiffe-helper bundling stage + conditional start.

CI matrix

.github/workflows/build.yaml cut from 9 entries to 3:

• proxy-init (still needed for envoy-sidecar iptables)
• authbridge-envoy
• authbridge

Removed: client-registration, auth-proxy, spiffe-helper,
authbridge-unified, authbridge-light, demo-app. The auth-proxy
and demo-app source stays in-tree for the standalone quickstart; just
not published by CI.

Backward compatibility

Existing release tags in ghcr.io continue to publish the old image
set unchanged. New tags cut from this branch only publish the 3
images above. Don't tag a new release until kagenti-operator
(Phase B) and the kagenti chart (Phase C) are updated to reference
the new image set — otherwise pulls break.

Test plan

• go test -race ./... in authbridge/authlib — passes
• go test -race ./... in authbridge/cmd/authbridge — passes
• go build ./... in all four cmd modules — passes
• podman build for Dockerfile.proxy — 47.8 MB image
• podman build for Dockerfile.envoy — 165 MB image
• End-to-end deployment in kind — deferred to Phase B coordination
  (operator must reference new image names)

Follow-ups (not in this PR)

Phase B (kagenti-operator):

• Default mode flip: envoy-sidecar → proxy-sidecar
• Image registry slot: Images.AuthBridgeLight → rename + repoint at
  new authbridge image
• Stop injecting spiffe-helper as separate sidecar in proxy-sidecar
  mode (it's bundled now)
• Drop combinedSidecar feature gate
• E2E test fixtures updated for new defaults

Phase C (kagenti chart):

• values.yaml defaults update
• Helm-emitted ConfigMap shape verification
• Drop combinedSidecar Helm flag

Documentation cleanup (separate PR):

• Demo manifests in authbridge/demos/**/k8s/ reference deleted
  image names
• Doc references in authbridge/README.md, authbridge/docs/*,
  cmd/authbridge/README.md, LOCAL_TESTING_GUIDE.md,
  local-build-and-test.sh
• Likely needs rewriting parts of demo walkthroughs (proxy-sidecar
  default changes the deployment shape)

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

[esnible]

Summary

Careful, well-documented image consolidation. The PR description is unusually thorough (test plan, sizes, follow-ups). Verified end-to-end:

• Shell supervisors are correctly written (set -eu, signal trap, intentional # shellcheck disable=SC2086 comments where word-splitting on $CRITICAL_PIDS is desired).
• All FROM lines pin a digest where appropriate; both runtime stages set USER (1001 / 1337); both bases ship bash 5.x so wait -n works.
• Go changes are pure comment updates — no behavior change.
• Cross-repo claim verified: kagenti-operator/internal/webhook/injector/keycloak_client_credentials.go:104-105 mounts at exactly /shared/client-id.txt and /shared/client-secret.txt — the same paths the deleted client-registration sidecar wrote to. The handoff is correct.
• Removed TestAuthbridgeCombinedYAML_Loads is justified (the YAML it tested is gone).

Areas reviewed: Shell, Dockerfiles, Go (comments), GitHub Actions, cross-repo (operator)
Commits: 2, both signed-off
CI status: 17/17 passing

Assisted-By: Claude Code

[esnible]

suggestion: The hardcoded sleep 2 between authbridge and Envoy is a race-window in two directions:

• If authbridge is slow to bind on a busy node (e.g. cold container, cgroup throttling), Envoy will fail its first ext_proc connection attempt and may crash before the listener is ready — wait -n then exits the container and kubelet restarts the pod, masking the issue as a slow startup loop.
• If authbridge binds in ~100ms (the common case), you've added ~1.9 s of cold-start latency to every pod for no benefit.

A listener probe is more robust and usually faster, e.g.:

for i in $(seq 1 50); do
  if (echo > /dev/tcp/127.0.0.1/<grpc-port>) 2>/dev/null; then break; fi
  sleep 0.1
done

(bash has /dev/tcp built in, no nc needed.) Or accept the simplicity tradeoff and document why sleep 2 is sufficient for the deployment shapes you target.